When introducing Cors for the nio http server transport, an issue was raised by @tvernum with our current Cors logic. Currently we set the "access-control-allow-origin" response header to to the request "origin" header if the host is the same. This is based on our expectation that this is the same origin.

However, in the Cors sense, an origin is (scheme, host, port). So this logic does not make sense. Additionally, it is not clear if we need to check if the origin is the same as that would not be a cross-origin resource sharing request.